bcoos 1.0.10 xoopsOption[pagetype] path traversal

Summaryinfo

A vulnerability has been found in bcoos 1.0.10 and classified as problematic. This issue affects some unknown processing. The manipulation of the argument xoopsOption[pagetype] leads to path traversal. This vulnerability is documented as CVE-2007-6079. Additionally, an exploit exists.

Detailsinfo

A vulnerability, which was classified as critical, has been found in bcoos 1.0.10. This issue affects an unknown part. The manipulation of the argument xoopsOption[pagetype] with an unknown input leads to a path traversal vulnerability. Using CWE to declare the problem leads to CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Directory traversal vulnerability in include/common.php in bcoos 1.0.10 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the xoopsOption[pagetype] parameter to the default URI for modules/news/. NOTE: this can be leveraged by using legitimate product functionality to upload a file that contains the code, then including that file.

The weakness was released 11/21/2007 by trueend5 (Website). It is possible to read the advisory at milw0rm.com. The identification of this vulnerability is CVE-2007-6079 since 11/21/2007. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details as well as a public exploit are known. The attack technique deployed by this issue is T1006 according to MITRE ATT&CK.

The exploit is available at exploit-db.com. It is declared as proof-of-concept.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the databases at X-Force (38592), Exploit-DB (4637) and SecurityFocus (BID 26505†). Entry connected to this vulnerability is available at VDB-39792. Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Name

• bcoos

Version

• 1.0.10

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion